Ploutoz Finance Oracle Attack - Revision history

Azoundria at 21:32, 7 May 2023

2023-05-07T21:32:54Z

← Older revision		Revision as of 15:32, 7 May 2023
Line 4:		Line 4:
	[[File:Ploutozfinance.jpg\|thumb\|Ploutoz Finance]]Ploutoz Finance is an audited decentralized lending platform on the Binance Smart Chain. Despite their audit, the protocol's smart contract hot wallet was still vulnerable to an oracle price exploit through a flash loan. $365k of funds were taken. There is no evidence of any funds being returned.		[[File:Ploutozfinance.jpg\|thumb\|Ploutoz Finance]]Ploutoz Finance is an audited decentralized lending platform on the Binance Smart Chain. Despite their audit, the protocol's smart contract hot wallet was still vulnerable to an oracle price exploit through a flash loan. $365k of funds were taken. There is no evidence of any funds being returned.

	This is a global/international case not involving a specific country.		This is a global/international case not involving a specific country.<ref name="insuraceblog-6155" /><ref name="coincodecapblog-6328" /><ref name="ploutozfinance-6329" /><ref name="ploutozfinance-6330" /><ref name="ploutozfinancetwitter-6331" /><ref name="ploutozfinancetwitter-6332" /><ref name="peckshieldtwitter-6333" /><ref name="bscscan-6334" /><ref name="thebittimes-6335" /><ref name="ptzfinancegithub-6336" /><ref name="reddit-6337" /><ref name="aliens-6338" /><ref name="linkedin-6339" /><ref name="defiyieldapp-6340" /><ref name="marketcap-6341" />
	<ref name="insuraceblog-6155" /><ref name="coincodecapblog-6328" /><ref name="ploutozfinance-6329" /><ref name="ploutozfinance-6330" /><ref name="ploutozfinancetwitter-6331" /><ref name="ploutozfinancetwitter-6332" /><ref name="peckshieldtwitter-6333" /><ref name="bscscan-6334" /><ref name="thebittimes-6335" /><ref name="ptzfinancegithub-6336" /><ref name="reddit-6337" /><ref name="aliens-6338" /><ref name="linkedin-6339" /><ref name="defiyieldapp-6340" /><ref name="marketcap-6341" />

	== About Ploutoz Finance ==		== About Ploutoz Finance ==
Line 58:		Line 57:
	!Description		!Description
	\|-		\|-
	\|November 23rd, 2021 2:24:07 AM		\|November 23rd, 2021 2:24:07 AM MST
	\|Main Event		\|Main Event
	\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.		\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
Line 66:		Line 65:
	\|		\|
	\|}		\|}

			== Technical Details ==
			This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

	== Total Amount Lost ==		== Total Amount Lost ==
Line 85:		Line 87:
	== Ongoing Developments ==		== Ongoing Developments ==
	What parts of this case are still remaining to be concluded?		What parts of this case are still remaining to be concluded?
			== Individual Prevention Policies ==
			{{Prevention:Individuals:Placeholder}}

			{{Prevention:Individuals:End}}

			== Platform Prevention Policies ==
			{{Prevention:Platforms:Placeholder}}

			{{Prevention:Platforms:End}}

			== Regulatory Prevention Policies ==
			{{Prevention:Regulators:Placeholder}}

	== Prevention ~~Policies ==~~		{{Prevention:Regulators:End}}
	~~Which policies could have prevented this event from happening?~~

	== References ==		== References ==

Azoundria at 23:59, 27 February 2023

2023-02-27T23:59:28Z

Azoundria: Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/ploutozfinanceoracleattack.php}} Ploutoz FinancePloutoz Finance is an audited decentralized lending platform on the Binance Smart Chain. Despite their audit, the protocol's smart contract hot wallet was still vulnerable to an oracle price exploit through a flash loan. $365k of funds were taken. There is no evidence of any funds being returned. This is a global/in..."

2023-01-28T04:03:41Z

Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/ploutozfinanceoracleattack.php}} thumb|Ploutoz FinancePloutoz Finance is an audited decentralized lending platform on the Binance Smart Chain. Despite their audit, the protocol's smart contract hot wallet was still vulnerable to an oracle price exploit through a flash loan. $365k of funds were taken. There is no evidence of any funds being returned. This is a global/in..."

New page

{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/ploutozfinanceoracleattack.php}}

[[File:Ploutozfinance.jpg|thumb|Ploutoz Finance]]Ploutoz Finance is an audited decentralized lending platform on the Binance Smart Chain. Despite their audit, the protocol's smart contract hot wallet was still vulnerable to an oracle price exploit through a flash loan. $365k of funds were taken. There is no evidence of any funds being returned.

This is a global/international case not involving a specific country.

== About Ploutoz Finance ==
"Ploutoz is an automated money market platform which provide 100% decentralized finance-based lending services in Binance Smart Chain." "Ploutoz allows users to efficiently lending crypto assets on the Binance Smart Chain."

"Ploutoz enables users to utilize their cryptocurrencies by as a lender, supplying collateral to the
network for supporting borrower by pledging over-collateralized asset."

"Ploutoz passed [a] smart contact audit from ThaiShield by ThaiChain."

"Ploutoz Finance, the BSC loan agreement, was attacked by a flash loan attack." On November 23rd, "Ploutoz finance was exploited and it led to the gain of ~$365K for the hacker."

"The hack was made possible due to the price oracle manipulation of DOP in Ploutoz finance." "The hacker manipulated the oracle price of DOP tokens and used the manipulated DOP as collateral to borrow other assets, including CAKE, ETH, BTCB, etc." "Specifically, the hacker leverages the manipulated DOP as collateral to borrow other assets, including CAKE, ETH, BTCB, etc."

"The attacker, who remains unknown, was able to drain the liquidity pools by way of a flash loan attack. A flash loan attack is when an attacker takes out a loan from one DeFi platform or service provider and uses the borrowed money to interact with smart contracts in a way that manipulates prices of DeFi tokens in their favor so that they can subsequently drain a project’s liquidity pool at prices favorable to them."

"The initial funds to launch the hack were withdrawn from TornadoCash. The resulting gains are swapped via paraswap and PancakeSwap, then washed via TornadoCash."

This is a global/international case not involving a specific country.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

* Known history of when and how the service was started.
* What problems does the company or service claim to solve?
* What marketing materials were used by the firm or business?
* Audits performed, and excerpts that may have been included.
* Business registration documents shown (fake or legitimate).
* How were people recruited to participate?
* Public warnings and announcements prior to the event.

Don't Include:
* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
* Anything that wasn't reasonably knowable at the time of the event.
There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

== The Reality ==
This sections is included if a case involved deception or information that was unknown at the time. Examples include:

* When the service was actually started (if different than the "official story").
* Who actually ran a service and their own personal history.
* How the service was structured behind the scenes. (For example, there was no "trading bot".)
* Details of what audits reported and how vulnerabilities were missed during auditing.

== What Happened ==
The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.
{| class="wikitable"
|+Key Event Timeline - Ploutoz Finance Oracle Attack
!Date
!Event
!Description
|-
|November 23rd, 2021 2:24:07 AM
|Main Event
|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
|-
|
|
|
|}

== Total Amount Lost ==
The total amount lost has been estimated at $365,000 USD.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

== Immediate Reactions ==
How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

== Ultimate Outcome ==
What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

== Total Amount Recovered ==
There do not appear to have been any funds recovered in this case.

What funds were recovered? What funds were reimbursed for those affected users?

== Ongoing Developments ==
What parts of this case are still remaining to be concluded?

== Prevention Policies ==
Which policies could have prevented this event from happening?

== References ==
[https://blog.insurace.io/security-incidents-in-november-e4bcb39dd7f9 https://blog.insurace.io/security-incidents-in-november-e4bcb39dd7f9] (Feb 1)

[https://blog.coincodecap.com/ploutoz-finance-exploited Ploutoz Finance Exploited Using A Price Oracle Manipulation Hack | CoinCodeCap] (Feb 9)

[https://www.ploutoz.finance/dashboard https://www.ploutoz.finance/dashboard] (Feb 10)

[https://www.ploutoz.finance/publish/whitepaper-ver.1.0.pdf https://www.ploutoz.finance/publish/whitepaper-ver.1.0.pdf] (Feb 10)

[https://twitter.com/ploutozfinance Ploutoz Finance Official (@ploutozfinance) | Twitter] (Feb 10)

[https://twitter.com/ploutozfinance/status/1406863528284155905 @ploutozfinance Twitter] (Feb 10)

[https://twitter.com/peckshield/status/1463093171261378572 @peckshield Twitter] (Feb 10)

[https://bscscan.com/tx/0x7fe46c2746855dd57e18f4d33522849ff192e4e26c74835799ba8dab89099457 https://bscscan.com/tx/0x7fe46c2746855dd57e18f4d33522849ff192e4e26c74835799ba8dab89099457] (Feb 10)

[https://thebittimes.com/token-PTZ-BSC-0x437dbc6ade5c2aed52bf5ccb54bf1b87a53cc436.html Ploutoz Finance 2.0( PTZ ) info, Ploutoz Finance 2.0( PTZ ) chart, market cap, and price | TheBitTimes.Com] (Feb 10)

[https://github.com/PTZFinance/ploutoz-finance/blob/main/POracle.sol ploutoz-finance/POracle.sol at main · PTZFinance/ploutoz-finance · GitHub] (Feb 10)

[https://www.reddit.com/r/coincodecap/comments/r11n1e/ploutoz_finance_exploited_using_a_price_oracle/ Ploutoz Finance Exploited using a Price Oracle Manipulation Hack : coincodecap] (Feb 10)

[https://www.aliens.com/read/ploutoz-finance-was-attacked-hackers-made-a-profit-of-365000-us-dollars Ploutoz Finance was attacked, hackers made a profit of 365,000 US dollars - Aliens: AI Crypto News & Markets Updates] (Feb 10)

[https://www.linkedin.com/posts/g-agrawal_ploutoz-finance-exploited-using-a-price-oracle-activity-6869210815275388928-EFVs/ Gaurav Agrawal on LinkedIn: Ploutoz Finance Exploited using a Price Oracle Manipulation Hack] (Feb 10)

[https://defiyield.app/rekt-database DEFIYIELD - DeFi Investing & Yield Farming Platform] (Feb 10)

[https://www.marketcap.one/m/PLO-215 PLOUTOZ (PLO) price, exchanges, chart - marketcap.one] (Feb 10)

← Older revision		Revision as of 17:59, 27 February 2023
Line 1:		Line 1:
	{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/ploutozfinanceoracleattack.php}}		{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/ploutozfinanceoracleattack.php}}
			{{Unattributed Sources}}

	[[File:Ploutozfinance.jpg\|thumb\|Ploutoz Finance]]Ploutoz Finance is an audited decentralized lending platform on the Binance Smart Chain. Despite their audit, the protocol's smart contract hot wallet was still vulnerable to an oracle price exploit through a flash loan. $365k of funds were taken. There is no evidence of any funds being returned.		[[File:Ploutozfinance.jpg\|thumb\|Ploutoz Finance]]Ploutoz Finance is an audited decentralized lending platform on the Binance Smart Chain. Despite their audit, the protocol's smart contract hot wallet was still vulnerable to an oracle price exploit through a flash loan. $365k of funds were taken. There is no evidence of any funds being returned.

	This is a global/international case not involving a specific country.		This is a global/international case not involving a specific country.
			<ref name="insuraceblog-6155" /><ref name="coincodecapblog-6328" /><ref name="ploutozfinance-6329" /><ref name="ploutozfinance-6330" /><ref name="ploutozfinancetwitter-6331" /><ref name="ploutozfinancetwitter-6332" /><ref name="peckshieldtwitter-6333" /><ref name="bscscan-6334" /><ref name="thebittimes-6335" /><ref name="ptzfinancegithub-6336" /><ref name="reddit-6337" /><ref name="aliens-6338" /><ref name="linkedin-6339" /><ref name="defiyieldapp-6340" /><ref name="marketcap-6341" />

	== About Ploutoz Finance ==		== About Ploutoz Finance ==
Line 88:		Line 90:

	== References ==		== References ==
	[https://blog.insurace.io/security-incidents-in-november-e4bcb39dd7f9 https://blog.insurace.io/security-incidents-in-november-e4bcb39dd7f9] (Feb 1)		<references><ref name="insuraceblog-6155">[https://blog.insurace.io/security-incidents-in-november-e4bcb39dd7f9 https://blog.insurace.io/security-incidents-in-november-e4bcb39dd7f9] (Feb 1, 2022)</ref>

	[https://blog.coincodecap.com/ploutoz-finance-exploited Ploutoz Finance Exploited Using A Price Oracle Manipulation Hack \| CoinCodeCap] (Feb 9)		<ref name="coincodecapblog-6328">[https://blog.coincodecap.com/ploutoz-finance-exploited Ploutoz Finance Exploited Using A Price Oracle Manipulation Hack \| CoinCodeCap] (Feb 9, 2022)</ref>

	[https://www.ploutoz.finance/dashboard https://www.ploutoz.finance/dashboard] (Feb 10)		<ref name="ploutozfinance-6329">[https://www.ploutoz.finance/dashboard https://www.ploutoz.finance/dashboard] (Feb 10, 2022)</ref>

	[https://www.ploutoz.finance/publish/whitepaper-ver.1.0.pdf https://www.ploutoz.finance/publish/whitepaper-ver.1.0.pdf] (Feb 10)		<ref name="ploutozfinance-6330">[https://www.ploutoz.finance/publish/whitepaper-ver.1.0.pdf https://www.ploutoz.finance/publish/whitepaper-ver.1.0.pdf] (Feb 10, 2022)</ref>

	[https://twitter.com/ploutozfinance Ploutoz Finance Official (@ploutozfinance) \| Twitter] (Feb 10)		<ref name="ploutozfinancetwitter-6331">[https://twitter.com/ploutozfinance Ploutoz Finance Official (@ploutozfinance) \| Twitter] (Feb 10, 2022)</ref>

	[https://twitter.com/ploutozfinance/status/1406863528284155905 @ploutozfinance Twitter] (Feb 10)		<ref name="ploutozfinancetwitter-6332">[https://twitter.com/ploutozfinance/status/1406863528284155905 @ploutozfinance Twitter] (Feb 10, 2022)</ref>

	[https://twitter.com/peckshield/status/1463093171261378572 @peckshield Twitter] (Feb 10)		<ref name="peckshieldtwitter-6333">[https://twitter.com/peckshield/status/1463093171261378572 @peckshield Twitter] (Feb 10, 2022)</ref>

	[https://bscscan.com/tx/0x7fe46c2746855dd57e18f4d33522849ff192e4e26c74835799ba8dab89099457 https://bscscan.com/tx/0x7fe46c2746855dd57e18f4d33522849ff192e4e26c74835799ba8dab89099457] (Feb 10)		<ref name="bscscan-6334">[https://bscscan.com/tx/0x7fe46c2746855dd57e18f4d33522849ff192e4e26c74835799ba8dab89099457 https://bscscan.com/tx/0x7fe46c2746855dd57e18f4d33522849ff192e4e26c74835799ba8dab89099457] (Feb 10, 2022)</ref>

	[https://thebittimes.com/token-PTZ-BSC-0x437dbc6ade5c2aed52bf5ccb54bf1b87a53cc436.html Ploutoz Finance 2.0( PTZ ) info, Ploutoz Finance 2.0( PTZ ) chart, market cap, and price \| TheBitTimes.Com] (Feb 10)		<ref name="thebittimes-6335">[https://thebittimes.com/token-PTZ-BSC-0x437dbc6ade5c2aed52bf5ccb54bf1b87a53cc436.html Ploutoz Finance 2.0( PTZ ) info, Ploutoz Finance 2.0( PTZ ) chart, market cap, and price \| TheBitTimes.Com] (Feb 10, 2022)</ref>

	[https://github.com/PTZFinance/ploutoz-finance/blob/main/POracle.sol ploutoz-finance/POracle.sol at main · PTZFinance/ploutoz-finance · GitHub] (Feb 10)		<ref name="ptzfinancegithub-6336">[https://github.com/PTZFinance/ploutoz-finance/blob/main/POracle.sol ploutoz-finance/POracle.sol at main · PTZFinance/ploutoz-finance · GitHub] (Feb 10, 2022)</ref>

	[https://www.reddit.com/r/coincodecap/comments/r11n1e/ploutoz_finance_exploited_using_a_price_oracle/ Ploutoz Finance Exploited using a Price Oracle Manipulation Hack : coincodecap] (Feb 10)		<ref name="reddit-6337">[https://www.reddit.com/r/coincodecap/comments/r11n1e/ploutoz_finance_exploited_using_a_price_oracle/ Ploutoz Finance Exploited using a Price Oracle Manipulation Hack : coincodecap] (Feb 10, 2022)</ref>

	[https://www.aliens.com/read/ploutoz-finance-was-attacked-hackers-made-a-profit-of-365000-us-dollars Ploutoz Finance was attacked, hackers made a profit of 365,000 US dollars - Aliens: AI Crypto News & Markets Updates] (Feb 10)		<ref name="aliens-6338">[https://www.aliens.com/read/ploutoz-finance-was-attacked-hackers-made-a-profit-of-365000-us-dollars Ploutoz Finance was attacked, hackers made a profit of 365,000 US dollars - Aliens: AI Crypto News & Markets Updates] (Feb 10, 2022)</ref>

	[https://www.linkedin.com/posts/g-agrawal_ploutoz-finance-exploited-using-a-price-oracle-activity-6869210815275388928-EFVs/ Gaurav Agrawal on LinkedIn: Ploutoz Finance Exploited using a Price Oracle Manipulation Hack] (Feb 10)		<ref name="linkedin-6339">[https://www.linkedin.com/posts/g-agrawal_ploutoz-finance-exploited-using-a-price-oracle-activity-6869210815275388928-EFVs/ Gaurav Agrawal on LinkedIn: Ploutoz Finance Exploited using a Price Oracle Manipulation Hack] (Feb 10, 2022)</ref>

	[https://defiyield.app/rekt-database DEFIYIELD - DeFi Investing & Yield Farming Platform] (Feb 10)		<ref name="defiyieldapp-6340">[https://defiyield.app/rekt-database DEFIYIELD - DeFi Investing & Yield Farming Platform] (Feb 10, 2022)</ref>

	[https://www.marketcap.one/m/PLO-215 PLOUTOZ (PLO) price, exchanges, chart - marketcap.one] (Feb 10)		<ref name="marketcap-6341">[https://www.marketcap.one/m/PLO-215 PLOUTOZ (PLO) price, exchanges, chart - marketcap.one] (Feb 10, 2022)</ref></references>